StackRadar

CVE-2026-94484

Medium

Advisory

Published 7 Oct 2026In the index since 8 Oct 2026
Severity
Medium
worst across findings
CVSS
4.8
base score, highest
EPSS
0.002
14th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
81
of 18,053 indexed, latest versions
Container images
78
deployed by those charts
Fix available
1 of 1
affected package

Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

Carried by container images the latest versions of 81 of 18,053 indexed charts deploy, on 78 images.

Affected packageAffected versionsFixed inImages
nextnpm15.0.1, 15.2.3, 15.2.4, 15.3.1+30 more15.5.27, 16.3.878
OSV records
GHSA-mcj8-r9mp-w47p

Charts affected

81 by stars
ChartLatestAffected imagesRadar Score
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
langgenius/dify-web:1.10.1-fix.1c306ac577912
next@15.5.7
15.5.27

Open the chart page →

82,159
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
langgenius/dify-web:1.16.187dd47e4e28f
next@16.2.12
16.3.8

Open the chart page →

72,701
homarrhomarr-labsOfficialVerified publisher8.32.01 of 1See more

homarr homarr-labs 8.32.0

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v2.2.01b4ea544e267
next@16.3.6
16.3.8

Open the chart page →

420
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latest27602401178d
next@16.2.6
16.3.8

Open the chart page →

3,557
homepagem0nsterrr-homepageVerified publisher5.4.01 of 1See more

homepage m0nsterrr-homepage 5.4.0

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.4.0643bd0be730d
next@16.3.3
16.3.8

Open the chart page →

648
umamichristianhuthVerified publisher7.14.11 of 2See more

umami christianhuth 7.14.1

1 of the 2 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
next@15.5.7
15.5.27

Open the chart page →

2,525
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
next@16.2.12
16.3.8

Open the chart page →

11,804
umamihelmforgeVerified publisher2.3.41 of 3See more

umami helmforge 2.3.4

1 of the 3 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.4.085909afc45bd
next@16.3.4
16.3.8

Open the chart page →

1,997
cosmocosmo-platformOfficialVerified publisher0.21.01 of 10See more

cosmo cosmo-platform 0.21.0

1 of the 10 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
next@15.2.4
15.5.27

Open the chart page →

34,376
duplistatusduplistatusVerified publisher1.3.01 of 2See more

duplistatus duplistatus 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
wsjbr/duplistatus:1.5.0bede86cf183f
next@16.3.6
16.3.8

Open the chart page →

1,080
flyte-binaryflyte2.0.511 of 4See more

flyte-binary flyte 2.0.51

1 of the 4 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/unionai-oss/flyteconsole-v2:latestd06cbcbf85dc
next@16.2.12
16.3.8

Open the chart page →

4,982
flyte-coreflyte2.0.511 of 3See more

flyte-core flyte 2.0.51

1 of the 3 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/unionai-oss/flyteconsole-v2:latestd06cbcbf85dc
next@16.2.12
16.3.8

Open the chart page →

790
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
next@15.5.13
15.5.27

Open the chart page →

5,254
agentareaagentareaVerified publisher0.0.261 of 17See more

agentarea agentarea 0.0.26

1 of the 17 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
agentarea/agentarea-frontend:latest56360a626a00
next@16.3.6
16.3.8

Open the chart page →

16,661
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
next@16.2.6
16.3.8

Open the chart page →

2,508
claude-code-hubclaude-code-hub0.1.01 of 4See more

claude-code-hub claude-code-hub 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/ding113/claude-code-hub:latestfa7c6f5428c2
next@16.3.3
16.3.8

Open the chart page →

2,113
growthbookgrowthbook5.1.01 of 2See more

growthbook growthbook 5.1.0

1 of the 2 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
growthbook/growthbook:5.1.0c8a124f55dca
next@16.3.5
16.3.8

Open the chart page →

1,257
kikplatekikplateVerified publisher0.22.01 of 3See more

kikplate kikplate 0.22.0

1 of the 3 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
next@15.5.14
15.5.27

Open the chart page →

3,282
kube-ingress-dash-chartkube-ingress-dashVerified publisher0.3.11 of 1See more

kube-ingress-dash-chart kube-ingress-dash 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
next@16.0.3
16.3.8

Open the chart page →

1,637
bulwark-maill4gVerified publisher0.2.21 of 1See more

bulwark-mail l4g 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
next@16.2.4
16.3.8

Open the chart page →

841
lakilakiOfficialVerified publisher1.11.01 of 2See more

laki laki 1.11.0

1 of the 2 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
next@16.3.0
16.3.8

Open the chart page →

543
growthbookone-acre-fundVerified publisher0.3.01 of 3See more

growthbook one-acre-fund 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
growthbook/growthbook:latest67b7cd7d12a1
next@16.3.5
16.3.8

Open the chart page →

1,589
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.31 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.3

1 of the 34 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.1.0-frontend28358db46206
next@16.3.5
16.3.8

Open the chart page →

24,860
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
prowlercloud/prowler-ui:5.31.179ee83c8e702
next@16.2.9
16.3.8

Open the chart page →

9,862
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
next@15.3.3
15.5.27

Open the chart page →

6,104
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
dserio83/velero-ui:0.3.1b4e1ec6664d3
next@15.2.3
15.5.27

Open the chart page →

13,135
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
next@16.2.11
16.3.8

Open the chart page →

21,601
u-storeunifieVerified publisher1.2.01 of 1See more

u-store unifie 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
next@15.0.1
15.5.27

Open the chart page →

16,773
wachdwachdVerified publisher0.4.371 of 1See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/wachd/wachd:0.4.1805b05c56da94
next@16.2.4
16.3.8

Open the chart page →

1,477
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
next@15.5.21
15.5.27

Open the chart page →

4,871
homepagealareira1.0.11 of 1See more

homepage alareira 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:latest643bd0be730d
next@16.3.3
16.3.8

Open the chart page →

648
pangolinbdcode0.14.11 of 1See more

pangolin bdcode 0.14.1

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
fosrl/pangolin:latest00cfb631097a
next@16.3.5
16.3.8

Open the chart page →

2,240
kamaji-consoleclastixVerified publisher0.1.31 of 1See more

kamaji-console clastix 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
next@15.2.3
15.5.27

Open the chart page →

3,224
kuberay-dashboarddanchevVerified publisher0.0.51 of 1See more

kuberay-dashboard danchev 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
quay.io/kuberay/dashboard:v1.7.07e43d4b4fd9f
next@15.5.18
15.5.27

Open the chart page →

735
desishowbiz-frontenddesishowbiz1.0.01 of 1See more

desishowbiz-frontend desishowbiz 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
rahulbhiwagade122/desishowbiz:latest08490b70998c
next@15.2.4
15.5.27

Open the chart page →

3,005
dial-admindialVerified publisher0.19.01 of 3See more

dial-admin dial 0.19.0

1 of the 3 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
epam/ai-dial-admin-frontend:0.21.01ecee9f1aa09
next@15.5.24
15.5.27

Open the chart page →

4,250
dyff-frontenddyff-frontendVerified publisher0.21.01 of 1See more

dyff-frontend dyff-frontend 0.21.0

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
registry.gitlab.com/dyff/dyff-frontend:0.21.06418c3c0d24a
next@15.5.18
15.5.27

Open the chart page →

1,383
fauxgpufauxgpuVerified publisher0.2.41 of 4See more

fauxgpu fauxgpu 0.2.4

1 of the 4 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/devops-dojo7/fauxgpu/web:0.2.4691dd15d6bca
next@16.3.1
16.3.8

Open the chart page →

3,775
flanksource-uiflanksourceVerified publisher1.4.3221 of 1See more

flanksource-ui flanksource 1.4.322

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
flanksource/incident-manager-ui:v1.4.3228d17f0c08b20
next@15.5.20
15.5.27

Open the chart page →

3,284
mission-controlflanksourceVerified publisher0.1.3391 of 8See more

mission-control flanksource 0.1.339

1 of the 8 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
flanksource/incident-manager-ui:v1.4.3228d17f0c08b20
next@15.5.20
15.5.27

Open the chart page →

10,966
glassflow-etlglassflowVerified publisher0.5.211 of 16See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/glassflow/glassflow-etl-fe:v3.2.05eaad43bd6c5
next@16.0.10
16.3.8

Open the chart page →

15,493
lobe-chathelm-charts-darox0.1.561 of 1See more

lobe-chat helm-charts-darox 0.1.56

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
lobehub/lobe-chat:1.96.9da0c21fefcd3
next@15.3.4
15.5.27

Open the chart page →

664
bulwark-mailhelmforgeVerified publisher1.0.01 of 1See more

bulwark-mail helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/bulwarkmail/webmail:1.11.2-always0d48c66f993f
next@16.3.3
16.3.8

Open the chart page →

87
homarrhelmforgeVerified publisher1.2.111 of 1See more

homarr helmforge 1.2.11

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v1.77.2f0fb462299af
next@16.3.0-preview.9
16.3.8

Open the chart page →

738
opencuthelmforgeVerified publisher1.1.111 of 5See more

opencut helmforge 1.1.11

1 of the 5 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
helmforge/opencut:v0.3.0bf11156e0ab5
next@16.1.3
16.3.8

Open the chart page →

3,586
reactive-resumehelmforgeVerified publisher1.0.01 of 4See more

reactive-resume helmforge 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
next@16.3.0
16.3.8

Open the chart page →

3,630
self-learning-platformhelm-self-learning-platformVerified publisher1.1.01 of 1See more

self-learning-platform helm-self-learning-platform 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
devopsiaci/self-learning-platform:1.1.3d9441c931f75
next@16.1.6
16.3.8

Open the chart page →

1,642
multicaicoretechVerified publisher0.6.21 of 4See more

multica icoretech 0.6.2

1 of the 4 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/multica-ai/multica-web:v0.6.1cc8260b03716
next@16.3.4
16.3.8

Open the chart page →

2,436
kagentkagent0.10.31 of 6See more

kagent kagent 0.10.3

1 of the 6 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/kagent-dev/kagent/ui:0.10.313f62914b66e
next@16.3.5
16.3.8

Open the chart page →

3,219
pangolinkrzwiatrzyk0.11.01 of 1See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
fosrl/pangolin:1.13.0c32ad797ab96
next@15.5.7
15.5.27

Open the chart page →

3,906

Container images carrying it

78 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
next@16.0.3
16.3.8
1
ghcr.io/kagent-dev/kagent/ui:0.10.313f62914b66e
next@16.3.5
16.3.8
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
next@15.3.3
15.5.27
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
next@16.2.12
16.3.8
1
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
next@15.5.14
15.5.27
1
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
next@16.3.0
16.3.8
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
next@15.5.21
15.5.27
1
ghcr.io/microboxlabs/miot-docs:latest84877c693d8a
next@16.3.5
16.3.8
1
ghcr.io/microboxlabs/miot-docs:latestb528e6a1d9d5
next@16.3.5
16.3.8
1
ghcr.io/multica-ai/multica-web:v0.6.1cc8260b03716
next@16.3.4
16.3.8
1
ghcr.io/open-telemetry/demo:3.1.0-frontend28358db46206
next@16.3.5
16.3.8
1
ghcr.io/quenchworks/images/homepageb63a85533463
next@16.3.6
16.3.8
1
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
next@15.5.4
15.5.27
1
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
next@16.2.6
16.3.8
1
ghcr.io/seerr-team/seerr:latest:v3.4.1f4768de5f616
next@16.2.6
16.3.8
1
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
next@15.2.4
15.5.27
1
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
next@15.2.4
15.5.27
1
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
next@15.2.4
15.5.27
1
ghcr.io/umami-software/umami:3.0.328f263fe06f7
next@15.5.9
15.5.27
1
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
next@15.5.7
15.5.27
1
ghcr.io/umami-software/umami:3.4.085909afc45bd
next@16.3.4
16.3.8
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
next@16.2.4
16.3.8
1
ghcr.io/wachd/wachd:0.4.1805b05c56da94
next@16.2.4
16.3.8
1
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
next@16.0.3
16.3.8
1
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
next@15.2.4
15.5.27
1
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
next@15.0.1
15.5.27
1
quay.io/kuberay/dashboard:v1.7.07e43d4b4fd9f
next@15.5.18
15.5.27
1
registry.gitlab.com/dyff/dyff-frontend:0.21.06418c3c0d24a
next@15.5.18
15.5.27
1

syft 1.42.1 · advisories as of 8 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.